Method and system of detecting computer network data leaks over optical channels

Abstract

A method and system for detecting computer network data leaks over optical channels, for example using a mobile phone or other handheld device to rapidly scan a room with many light sources to identify the hidden transmission of data via optical steganography. The method of identification leverages spectral divergence created by the entropy produced by steganographically embedding data in the optical channel. The method and system proceed through multiple steps that can be computed in near real-time to eliminate background spectrum effects and isolate likely sources of information. The user or automated detection system captures a short video, and the video frames are then subdivided into smaller blocks effectively producing many adjacent videos of smaller pixel area.

What is claimed is: 
     
       1. A method of detecting computer network data leaks over optical channels comprising:
 capturing a video of a target area; 
 subdividing frames of the video into smaller blocks to generate a plurality of video clips; 
 applying a Fast Fourier transform (FFT) to the plurality of video clips, wherein an average luminance of the plurality of video clips is represented in the frequency domain; 
 applying a bandpass filter to the frequency domain representations, wherein the bandpass filter eliminates one or more strong tones in the plurality of video clips; 
 analyzing the spectral divergence of the bandpass filtered frequency domain representation; and 
 identifying suspect transmissions, wherein suspect transmissions are areas having higher spectral entropy in the plurality of video clips. 
 
     
     
       2. The method of  claim 1 , further comprising:
 displaying a representation of one bandpass filtered representation, wherein suspected areas having a high spectral entropy are highlighted. 
 
     
     
       3. The method of  claim 1 , further comprising:
 performing a threshold comparison for each video clip prior to applying the bandpass filter. 
 
     
     
       4. The method of  claim 1 , wherein the average luminance is the spectral density of an area. 
     
     
       5. The method of  claim 1 , wherein the one or more strong tones are selected from the group consisting of: task lighting, room lighting, outside ambient noise, or combination thereof. 
     
     
       6. The method of  claim 1 , wherein the identified suspect areas are modulated optical transmissions selected from the group consisting of: a keyboard light, a computer monitor screen, a hard drive status LEDs, peripheral indicator lights, or any combination thereof. 
     
     
       7. The method of  claim 1 , further comprising:
 calculating the power spectral density of an ambient environment, wherein the power spectral density of an environment is background noise. 
 
     
     
       8. A system for detecting computer network data leaks over optical channels comprising:
 a video capturing device; and 
 a video processing unit;
 wherein the video processing unit is the video capturing device; 
 
 the system performing a method of detecting computer network data leaks over optical channels comprising: 
 capturing a video of a target area; 
 subdividing frames of the video into smaller blocks to generate a plurality of video clips; 
 applying a FFT to the plurality of video clips, wherein an average luminance of the plurality of video clips is represented in the frequency domain; 
 applying a bandpass filter to the frequency domain representations, wherein the bandpass filter eliminates one or more strong tones in the plurality of video clips; 
 analyzing the spectral divergence of the bandpass filtered frequency domain representation; and 
 identifying suspect transmissions, wherein suspect transmissions are areas having higher spectral entropy in the plurality of video clips. 
 
     
     
       9. The system of  claim 8 , displaying one or more video clips on a video display;
 wherein the one or more video clips is a representation of a bandpass filtered frequency domain representation; and 
 wherein the one or more video clips highlights an area with a high spectral entropy. 
 
     
     
       10. The system of  claim 8 , further comprising:
 performing a threshold comparison for each video clip prior to applying the bandpass filter. 
 
     
     
       11. The system of  claim 8 , wherein the one or more strong tones are associated with an ambient light signal and an associated power spectral density is calculated indirectly as an autocorrelation. 
     
     
       12. The system of  claim 8 , wherein the one or more strong tones are selected from the group consisting of: task lighting, room lighting, outside ambient noise, or combination thereof;
 wherein the system calculates the power spectral density of an ambient environment; and 
 wherein the power spectral density is a FFT of an autocorrelation of one or more strong tones of the plurality of video clips. 
 
     
     
       13. The system of  claim 8 , wherein the identified suspect areas are modulated optical transmissions selected from the group consisting of: a keyboard light, a computer monitor screen, a hard drive status LEDs, peripheral indicator lights, or any combination thereof. 
     
     
       14. The system of  claim 8 , further comprising:
 calculating the power spectral density of an ambient environment, wherein the power spectral density is a FFT of an autocorrelation of one or more strong tones of the plurality of video clips. 
 
     
     
       15. A method of detecting computer network data leaks over optical channels comprising:
 capturing a video of a target area; 
 subdividing frames of the video into smaller blocks to generate a plurality of video clips; 
 generating a corresponding frequency domain representation of an average luminance of each of the video clips; 
 applying a bandpass filter to each of the frequency domain representations, wherein one or more strong tones are eliminated; 
 analyzing the spectral divergence of the bandpass filtered frequency domain representation; and 
 identifying suspect transmissions, wherein suspect transmissions are areas having higher spectral entropy in the plurality of video clips. 
 
     
     
       16. The system of  claim 15 , further comprising:
 displaying a representation of one bandpass filtered representation, wherein suspected areas having a high spectral entropy are highlighted. 
 
     
     
       17. The system of  claim 15 , further comprising:
 performing a threshold comparison for each video clip prior to applying the bandpass filter. 
 
     
     
       18. The system of  claim 15 , wherein the one or more strong tones are associated with an ambient light signal and an associated power spectral density is calculated indirectly as an autocorrelation. 
     
     
       19. The system of  claim 15 , wherein the one or more strong tones are selected from the group consisting of: task lighting, room lighting, outside ambient noise, or combination thereof. 
     
     
       20. The system of  claim 15 , wherein the identified suspect areas are modulated optical transmissions selected from the group consisting of: a keyboard light, a computer monitor screen, a hard drive status LEDs, peripheral indicator lights, or any combination thereof.